console.cloud.google.com (APIs & Services → Credentials), enable the
Google Drive API, and add https:///oauth/google/callback
as an authorized redirect URI. The secret is stored under /data only.
Read-only Google scope; uploads go through Proton's end-to-end encryption. Nothing sensitive is stored: tokens and the Proton session live in memory only. The resume manifest (Google file IDs, no credentials) is kept under /data.